#1116557 cuetools: Buffer overflow in time.c time_frame_to_mmssff

Package:
cuetools
Source:
cuetools
Description:
tools for manipulating CUE/TOC files
Submitter:
Xi Rui
Date:
2025-09-29 10:53:01 UTC
Severity:
normal
#1116557#5
Date:
2025-09-28 15:12:43 UTC
From:
To:
Hello,

There is a buffer overflow issue in cuetools src/lib/time.c time_frame_to_mmssff
function. This function uses sprintf to format time into a buffer without
limiting boundary.

Reproduce with a cue file and cueconvert:

###
FILE "COCC-18150.wav" WAVE
  TRACK 01 AUDIO
    INDEX 01 11111111:00:00
###

I checked debian bug tracker and found this bug is firstly discovered in #576367.
But the patch for that is incorrect. It only increase buffer size by one, which
makes the issue still exists. I guess the correct fix should be replacing sprintf
with snprintf.
#1116557#10
Date:
2025-09-29 10:43:40 UTC
From:
To:
Hello,

I've created a commit to fix this issue. Git patch file is sent as the attachment. Also opened a pr in upstream repository: https://github.com/svend/cuetools/pull/44